@poe-platform/safe-bash 0.1.799 → 0.1.800

package/dist/safe-bash/command-chunks/chunk-BNOU5YQS.js

@@ -0,0 +1,182 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-tar/src/stream.ts
+init_buffer();
+import { boundedCodec } from "../../safe-bash-compression-engine/bounded-codec.js";
+import { codec, CodecReader } from "../../safe-bash-compression-engine/codec.js";
+import { compressionDiagnostic } from "../../safe-bash-compression-engine/errors.js";
+import { profiles as sharedProfiles } from "../../safe-bash-compression-engine/options.js";
+import { xzProfile } from "../../safe-bash-command-xz/options.js";
+import { readBytes } from "../../safe-bash-contracts/index.js";
+import { bounded, fail } from "../../safe-bash-io-engine/commands/archive/internal.js";
+var profiles = [...sharedProfiles, xzProfile];
+async function* compressed(source, decode, signal, limits, format = "gzip") {
+  signal.throwIfAborted();
+  const controller = new AbortController();
+  const combined = AbortSignal.any([signal, controller.signal]);
+  const reader = new CodecReader(bounded(source, limits.maxArchiveBytes, combined, limits.chunkSize), combined);
+  let hasFailure = false;
+  let failure;
+  try {
+    const onFailure = (error) => {
+      if (!hasFailure) {
+        hasFailure = true;
+        failure = error;
+        controller.abort(error);
+      }
+    };
+    const output = format === "gzip" ? codec(reader, { mode: decode ? "gunzip" : "gzip", chunkSize: limits.chunkSize, onFailure }, combined) : boundedCodec(reader, { format, decompress: decode, level: profiles.find((profile) => profile.format === format).level, onFailure }, combined);
+    yield* bounded(output, limits.maxArchiveBytes, combined, limits.chunkSize);
+  } catch (error) {
+    signal.throwIfAborted();
+    throw compressionDiagnostic(hasFailure ? failure : error);
+  } finally {
+    controller.abort(new Error("archive compression finished"));
+    await reader.close();
+  }
+}
+async function* autodetected(source, signal, limits) {
+  const iterator = readBytes(source, signal)[Symbol.asyncIterator]();
+  try {
+    const prefix = new Uint8Array(6);
+    let size = 0;
+    let remainder;
+    while (size < prefix.length) {
+      const next = await iterator.next();
+      if (next.done) break;
+      const chunk = next.value;
+      if (!chunk.length) continue;
+      const take = Math.min(prefix.length - size, chunk.length);
+      prefix.set(chunk.subarray(0, take), size);
+      size += take;
+      if (take < chunk.length) {
+        remainder = chunk.subarray(take);
+        break;
+      }
+    }
+    const replay = (async function* () {
+      yield prefix.subarray(0, size);
+      if (remainder) yield remainder;
+      for (; ; ) {
+        const next = await iterator.next();
+        if (next.done) return;
+        if (next.value.length) yield next.value;
+      }
+    })();
+    const format = size >= 2 && prefix[0] === 31 && prefix[1] === 139 ? "gzip" : size >= 3 && prefix[0] === 66 && prefix[1] === 90 && prefix[2] === 104 ? "bzip2" : size === 6 && [253, 55, 122, 88, 90, 0].every((byte, index) => prefix[index] === byte) ? "xz" : void 0;
+    yield* format ? compressed(replay, true, signal, limits, format) : replay;
+  } finally {
+    if (iterator.return) await iterator.return(void 0);
+  }
+}
+function recordPadding(size, recordSize, maximum) {
+  const padding = (recordSize - size % recordSize) % recordSize;
+  if (!Number.isSafeInteger(size) || size < 0 || size > maximum || padding > maximum - size) fail("archive byte limit exceeded");
+  return padding;
+}
+async function* recorded(source, options, budget) {
+  let size = 0;
+  for await (const chunk of readBytes(source, budget.context.signal)) {
+    if (chunk.length > budget.limits.maxArchiveBytes - size) fail("archive byte limit exceeded");
+    size += chunk.length;
+    yield chunk;
+  }
+  let padding = recordPadding(size, options.recordSize, budget.limits.maxArchiveBytes);
+  while (padding > 0) {
+    budget.context.signal.throwIfAborted();
+    const length = Math.min(padding, budget.limits.chunkSize);
+    size += length;
+    padding -= length;
+    yield new Uint8Array(length);
+  }
+  if (options.totals) await budget.output(`Total bytes written: ${size}
+`, true);
+}
+var Reader = class {
+  constructor(source, signal) {
+    this.signal = signal;
+    this.iterator = readBytes(source, signal)[Symbol.asyncIterator]();
+  }
+  signal;
+  position = 0;
+  iterator;
+  chunk = new Uint8Array();
+  offset = 0;
+  async take(maximum) {
+    this.signal.throwIfAborted();
+    while (this.offset === this.chunk.length) {
+      const result = await this.iterator.next();
+      if (result.done) return void 0;
+      this.chunk = result.value;
+      this.offset = 0;
+    }
+    const end = Math.min(this.chunk.length, this.offset + maximum);
+    const bytes = this.chunk.subarray(this.offset, end);
+    this.offset = end;
+    this.position += bytes.length;
+    return bytes;
+  }
+  async exact(size) {
+    this.signal.throwIfAborted();
+    if (this.chunk.length - this.offset >= size) {
+      const bytes = this.chunk.subarray(this.offset, this.offset + size);
+      this.offset += size;
+      this.position += size;
+      return bytes;
+    }
+    const result = new Uint8Array(size);
+    let offset = 0;
+    while (offset < size) {
+      const bytes = await this.take(size - offset);
+      if (!bytes) fail("truncated archive");
+      result.set(bytes, offset);
+      offset += bytes.length;
+    }
+    return result;
+  }
+  async *body(size) {
+    let remaining = size;
+    while (remaining > 0) {
+      const bytes = await this.take(remaining);
+      if (!bytes) fail("truncated archive body");
+      remaining -= bytes.length;
+      yield bytes;
+    }
+  }
+  async discard(size) {
+    this.signal.throwIfAborted();
+    if (size === 0) return;
+    if (this.chunk.length - this.offset >= size) {
+      this.offset += size;
+      this.position += size;
+      return;
+    }
+    for await (const ignoredChunk of this.body(size)) this.signal.throwIfAborted();
+  }
+  async padding(size) {
+    await this.discard((512 - size % 512) % 512);
+  }
+  async finish() {
+    let trailing = 0;
+    while (true) {
+      const bytes = await this.take(64 * 1024);
+      if (!bytes) break;
+      if (bytes.some((byte) => byte !== 0)) fail("nonzero trailing archive data or concatenated archive is unsupported");
+      trailing += bytes.length;
+    }
+    if (trailing % 512 !== 0) fail("truncated archive trailing record");
+  }
+  async close() {
+    if (this.iterator.return) await this.iterator.return();
+  }
+};
+
+export {
+  compressed,
+  autodetected,
+  recordPadding,
+  recorded,
+  Reader
+};

package/dist/safe-bash/command-chunks/chunk-C7I25AAL.js

@@ -0,0 +1,25 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-tar/src/listing.ts
+init_buffer();
+import { encodeBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+function quoteName(name, style) {
+  if (style === "literal") return name;
+  const escapes = { "\x07": "\\a", "\b": "\\b", "	": "\\t", "\n": "\\n", "\v": "\\v", "\f": "\\f", "\r": "\\r" };
+  let result = style === "c" ? '"' : "";
+  for (const character of name) {
+    const escape = escapes[character];
+    if (escape !== void 0) result += escape;
+    else if (style === "c" && character === '"' || character === "\\") result += `\\${character}`;
+    else if (character.charCodeAt(0) < 32 || character.charCodeAt(0) >= 127 && character.charCodeAt(0) <= 159 || character === "\u2028" || character === "\u2029") {
+      for (const byte of encodeBytes(character)) result += `\\${byte.toString(8).padStart(3, "0")}`;
+    } else result += character;
+  }
+  return style === "c" ? result + '"' : result;
+}
+
+export {
+  quoteName
+};

package/dist/safe-bash/command-chunks/chunk-CKXV2CLD.js

@@ -0,0 +1,65 @@
+import {
+  CurlError
+} from "./chunk-IYPAQ7PH.js";
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-network-engine/src/form-content-type.ts
+init_buffer();
+function token(character) {
+  if (character === void 0) return false;
+  const code = character.charCodeAt(0);
+  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || "!#$%&'*+-.^_`|~".includes(character);
+}
+function formContentType(input, start, fileList = false) {
+  let end = start;
+  const invalid = () => {
+    throw new CurlError(2, "Invalid multipart content type");
+  };
+  const readToken = () => {
+    const begin = end;
+    while (token(input[end])) end++;
+    if (end === begin) invalid();
+  };
+  const whitespace = () => {
+    while (input[end] === " " || input[end] === "	") end++;
+  };
+  readToken();
+  if (input[end++] !== "/") invalid();
+  readToken();
+  whitespace();
+  while (end < input.length) {
+    if (fileList && input[end] === ",") break;
+    if (input[end] !== ";") invalid();
+    const separator = end++;
+    whitespace();
+    if (["type=", "filename=", "encoder=", "headers="].some((attribute) => input.startsWith(attribute, end))) {
+      return { value: input.slice(start, separator), end: separator };
+    }
+    readToken();
+    whitespace();
+    if (input[end++] !== "=") invalid();
+    whitespace();
+    if (input[end] === '"') {
+      end++;
+      let closed = false;
+      while (end < input.length) {
+        const character = input[end++];
+        if (character === '"') {
+          closed = true;
+          break;
+        }
+        const literal = character === "\\" ? input[end++] : character;
+        if (literal === void 0 || literal.charCodeAt(0) < 32 || literal.charCodeAt(0) === 127) invalid();
+      }
+      if (!closed) invalid();
+    } else readToken();
+    whitespace();
+  }
+  return { value: input.slice(start, end), end };
+}
+
+export {
+  formContentType
+};

package/dist/safe-bash/command-chunks/chunk-CQ5YGOGB.js

@@ -0,0 +1,150 @@
+import {
+  init_buffer
+} from "./chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-sed/src/inplace.ts
+init_buffer();
+import { retainFileSystemCleanup } from "@poe-platform/safe-fs/core";
+import { dirname, FsError, joinPath } from "../../safe-bash-contracts/index.js";
+import { compareCopyIdentity } from "../../safe-bash-contracts/filesystem-identity.js";
+import { writeFileOutput } from "../../safe-bash-contracts/filesystem-output.js";
+import { decodeBytes, encodeBytes } from "../../safe-bash-io-engine/byte-encoding.js";
+import { bytes, virtualPath } from "../../safe-bash-io-engine/commands/text-programs/shared.js";
+async function prepareInPlace(context, files, suffix) {
+  const fs = context.fs;
+  if (!fs.confineExtraction || !fs.writeFileConditional || !fs.openReadFile) {
+    throw new FsError("ENOTSUP", { message: "in-place editing requires retained ancestry, retained reads and atomic conditional writes" });
+  }
+  const targets = [];
+  for (const file of files) {
+    const operand = virtualPath(context, file);
+    const path = "/" + operand.split("/").filter((part) => part && part !== ".").join("/");
+    const capabilities = await fs.capabilitiesFor?.(path, { signal: context.signal }) ?? fs.capabilities;
+    if (capabilities.atomicFileMutation !== true || capabilities.retainedRead !== true) {
+      throw new FsError("ENOTSUP", { path, message: "in-place editing requires retained reads and atomic conditional writes" });
+    }
+    const parent = await fs.lstat(dirname(path), { signal: context.signal });
+    const original = await fs.lstat(operand, { signal: context.signal });
+    if (parent.type !== "directory" || original.type !== "file") throw new FsError("ENOTSUP", { path, message: "in-place editing requires regular files and directory parents" });
+    let backup = null;
+    const backupAncestors = [];
+    if (suffix) {
+      try {
+        backup = await fs.lstat(path + suffix, { signal: context.signal });
+      } catch (error) {
+        if (!(error instanceof FsError) || error.code !== "ENOENT") throw error;
+      }
+      if (backup && backup.type !== "file") throw new FsError("ENOTSUP", { path: path + suffix, message: "in-place backups require regular files" });
+      if (backup && compareCopyIdentity(original, backup) === "same") throw new FsError("EINVAL", { path, message: "backup aliases the edited file" });
+      if (backup && (backup.mode & 4095) !== (original.mode & 4095)) {
+        const backupCapabilities = await fs.capabilitiesFor?.(path + suffix, { signal: context.signal }) ?? fs.capabilities;
+        if (backupCapabilities.atomicFileStaging !== true || backupCapabilities.atomicStagingAncestry !== true || !fs.createStagedFile || !fs.publishStagedFile || !fs.removeStagedFile) {
+          throw new FsError("ENOTSUP", { path: path + suffix, message: "preserving backup permissions requires atomic staging with ancestry verification" });
+        }
+        for (let directory = dirname(path); ; directory = dirname(directory)) {
+          const stat = directory === dirname(path) ? parent : await fs.lstat(directory, { signal: context.signal });
+          if (stat.type !== "directory") throw new FsError("ENOTSUP", { path: directory, message: "in-place backups require directory ancestry" });
+          backupAncestors.unshift({ path: directory, stat });
+          if (directory === "/") break;
+        }
+      }
+    }
+    targets.push({ path, parent, original, backup, backupAncestors });
+  }
+  const view = await fs.confineExtraction([...new Set(targets.map((target) => dirname(target.path)))], { signal: context.signal });
+  if (!view.writeFileConditional) throw new FsError("ENOTSUP", { message: "in-place editing requires atomic conditional writes" });
+  return targets.map((target) => ({ ...target, fs: view }));
+}
+async function replaceBackup(context, target, suffix, data) {
+  let staging;
+  let operation;
+  let failure;
+  let closed = false;
+  const release = retainFileSystemCleanup(context.fs, async (view) => {
+    await operation?.catch(() => {
+    });
+    if (staging) await view.removeStagedFile(staging);
+  }, { maxOperations: 1 });
+  const cleanup = () => {
+    closed = true;
+    return release();
+  };
+  context.registerCleanup?.(cleanup);
+  try {
+    operation = Promise.resolve().then(async () => {
+      context.signal.throwIfAborted();
+      if (closed) throw new FsError("EPIPE", { message: "in-place backup publication is closed" });
+      staging = await context.fs.createStagedFile(joinPath(dirname(target.path), `.sed-${globalThis.crypto.randomUUID()}`), "backup", {
+        type: "file",
+        data
+      }, { parent: target.parent, mode: target.original.mode & 4095, signal: context.signal });
+      context.signal.throwIfAborted();
+      if (closed) throw new FsError("EPIPE", { message: "in-place backup publication is closed" });
+      await context.fs.publishStagedFile(staging, target.path + suffix, {
+        parent: target.parent,
+        destination: target.backup,
+        ancestors: target.backupAncestors,
+        signal: context.signal
+      });
+      context.signal.throwIfAborted();
+    });
+    await operation;
+  } catch (error) {
+    failure = { reason: error };
+  }
+  try {
+    await cleanup();
+  } catch (error) {
+    if (failure) throw new AggregateError([failure.reason, error], "in-place backup publication and cleanup failed");
+    throw error;
+  }
+  if (failure) throw failure.reason;
+}
+async function editInPlace(context, target, suffix, budget, run) {
+  const reader = await context.fs.openReadFile(target.path, { signal: context.signal });
+  let closing;
+  const close = () => closing ??= reader.close();
+  try {
+    context.registerCleanup?.(close);
+    const identity = compareCopyIdentity(target.original, await reader.stat({ signal: context.signal }));
+    if (identity !== "same") throw new FsError(identity === "unknown" ? "ENOTSUP" : "EAGAIN", { path: target.path, message: "in-place reader does not match the inspected file" });
+    const source = async function* () {
+      let position = 0;
+      while (true) {
+        const chunk = await reader.read(position, 64 * 1024, { signal: context.signal });
+        if (!chunk.byteLength) return;
+        position += chunk.byteLength;
+        yield chunk;
+      }
+    };
+    const { data, result } = await run(source());
+    if (suffix) {
+      let original = "";
+      for await (const chunk of source()) {
+        budget.step();
+        original = budget.check(original + decodeBytes(encodeBytes(chunk), "latin1"));
+        await budget.checkpoint();
+      }
+      context.signal.throwIfAborted();
+      if (target.backupAncestors.length) await replaceBackup(context, target, suffix, bytes(original));
+      else await target.fs.writeFileConditional(target.path + suffix, bytes(original), {
+        parent: target.parent,
+        expected: target.backup,
+        mode: target.original.mode & 4095,
+        signal: context.signal
+      });
+      context.signal.throwIfAborted();
+    }
+    await writeFileOutput(context, data, async (chunk) => {
+      await target.fs.writeFileConditional(target.path, chunk, { parent: target.parent, expected: target.original, signal: context.signal });
+    });
+    return result;
+  } finally {
+    await close();
+  }
+}
+
+export {
+  prepareInPlace,
+  editInPlace
+};

package/dist/safe-bash/command-chunks/{chunk-I3K5RYU4.js → chunk-D4OP2BR3.js}

@@ -2,7 +2,7 @@ import {
   JqError,
   JqLimitError,
   wellFormed
-} from "./chunk-VVI4Z73I.js";
+} from "./chunk-QP4R6GLA.js";
 import {
   utf8ByteLength
 } from "./chunk-PDKXAR4Y.js";
@@ -43,6 +43,17 @@ var precedence = Object.freeze({
 });
 var functions = Object.freeze({
   walk: [1],
+  test: [1, 2],
+  match: [1, 2],
+  in: [1],
+  IN: [1, 2],
+  INDEX: [1, 2],
+  isempty: [1],
+  nth: [1, 2],
+  pick: [1],
+  sqrt: [0],
+  todate: [0],
+  fromdate: [0],
   explode: [0],
   implode: [0],
   utf8bytelength: [0],
@@ -56,7 +67,11 @@ var functions = Object.freeze({
   until: [2],
   fromdateiso8601: [0],
   todateiso8601: [0],
-  scan: [1],
+  strftime: [1],
+  strptime: [1],
+  gmtime: [0],
+  mktime: [0],
+  scan: [1, 2],
   paths: [0, 1],
   getpath: [1],
   flatten: [0, 1],
@@ -94,14 +109,15 @@ var functions = Object.freeze({
   not: [0],
   reverse: [0],
   transpose: [0],
-  combinations: [0],
+  combinations: [0, 1],
   first: [0, 1],
   last: [0, 1],
   limit: [2],
   range: [1, 2, 3],
   join: [1],
   split: [1],
-  splits: [1],
+  splits: [1, 2],
+  sub: [2, 3],
   gsub: [2, 3],
   tostring: [0],
   tonumber: [0],
@@ -251,7 +267,7 @@ function isPath(ast) {
     if (node.kind === "identity" || node.kind === "parameter" || node.kind === "invoke" || node.kind === "descend") continue;
     if (node.kind === "index" || node.kind === "iterate" || node.kind === "slice") pending.push(node.base);
     else if (node.kind === "optional") pending.push(node.operand);
-    else if (node.kind === "bind") pending.push(node.body);
+    else if (node.kind === "bind" || node.kind === "define") pending.push(node.body);
     else if (node.kind === "call" && ["select", "values", "strings", "numbers", "booleans", "arrays", "objects", "nulls", "scalars", "iterables", "empty"].includes(node.name)) continue;
     else if (node.kind === "binary" && (node.operator === "," || node.operator === "|")) pending.push(node.left, node.right);
     else return false;
@@ -393,6 +409,17 @@ jq: 1 compile error`, 3);
   const expression = (minimum = 0, stopComma = false) => {
     if (++nesting > limits.maxAstDepth) throw new JqLimitError("maxAstDepth");
     try {
+      if (peek().text === "def") {
+        const previous = new Map(definitions);
+        try {
+          const entries2 = [];
+          while (accept("def")) entries2.push(definition());
+          return { kind: "define", definitions: entries2, body: expression(0, stopComma) };
+        } finally {
+          definitions.clear();
+          for (const [name, value] of previous) definitions.set(name, value);
+        }
+      }
       let left = primary();
       while (true) {
         const operator = peek().text;
@@ -405,9 +432,9 @@ jq: 1 compile error`, 3);
           const previous = new Map([...names].map((name) => [name, bindings.get(name) ?? 0]));
           for (const [name, count] of previous) bindings.set(name, count + 1);
           try {
-            const body = expression(0, stopComma);
+            const body2 = expression(0, stopComma);
             const single = patterns[0];
-            left = patterns.length === 1 && single.kind === "variable" ? { kind: "bind", source: left, name: single.name, body } : { kind: "destructure", source: left, patterns, names: [...names], body };
+            left = patterns.length === 1 && single.kind === "variable" ? { kind: "bind", source: left, name: single.name, body: body2 } : { kind: "destructure", source: left, patterns, names: [...names], body: body2 };
           } finally {
             for (const [name, count] of previous) {
               if (count) bindings.set(name, count);
@@ -472,8 +499,8 @@ jq: 1 compile error`, 3);
       if (target === void 0) fail(`undefined label $${name.text}`);
       result = { kind: "break", target };
     } else if (token.text === "try") {
-      const body = expression(10);
-      result = { kind: "try", body, handler: accept("catch") ? expression(10) : void 0 };
+      const body2 = expression(10);
+      result = { kind: "try", body: body2, handler: accept("catch") ? expression(10) : void 0 };
     } else if (token.text === "reduce" || token.text === "foreach") {
       const source2 = expression(10);
       expect("as");
@@ -551,10 +578,10 @@ jq: 1 compile error`, 3);
         expect(")");
       }
       if (token.text === "split" && args.length === 2) fail("unsupported function split/2");
-      const definition = definitions.get(`${name}/${args.length}`);
+      const definition2 = definitions.get(`${name}/${args.length}`);
       const parameter = parameters.get(name);
       if (parameter && !args.length) result = parameter;
-      else if (definition?.kind === "invoke") result = { ...definition, args };
+      else if (definition2?.kind === "invoke") result = { ...definition2, args };
       else {
         result = { kind: "call", name, args };
         if (!Object.hasOwn(functions, name) || !functions[name].includes(args.length)) unresolved.set(result, token);
@@ -584,7 +611,12 @@ jq: 1 compile error`, 3);
     return result;
   };
   const bodies = [];
-  while (definitions && accept("def")) {
+  const definition = () => {
+    const previousParameters = new Map(parameters);
+    const previousBindings = new Map(bindings);
+    const previousDefinitions = new Map(definitions);
+    const previousDefining = defining;
+    const names = /* @__PURE__ */ new Set();
     budget.step();
     const name = take();
     if (name.kind !== "name") fail("expected function name");
@@ -594,7 +626,8 @@ jq: 1 compile error`, 3);
       do {
         const value = accept("$");
         const parameter = take();
-        if (parameter.kind !== "name" || parameters.has(parameter.text) || parameters.has(`$${parameter.text}`)) fail("expected unique parameter name");
+        if (parameter.kind !== "name" || names.has(parameter.text)) fail("expected unique parameter name");
+        names.add(parameter.text);
         const node = { kind: "parameter", name: parameter.text };
         parameters.set(value ? `$${parameter.text}` : parameter.text, node);
         formal.push(node);
@@ -605,32 +638,47 @@ jq: 1 compile error`, 3);
       expect(")");
     }
     expect(":");
+    const entry = { kind: "invoke", definition: { parameters: formal, body: { kind: "identity" } }, args: [] };
+    const signature = `${name.text}/${formal.length}`;
+    definitions.set(signature, entry);
     defining = true;
-    let body;
+    let body2;
     try {
-      body = expression();
+      body2 = expression();
     } finally {
-      defining = false;
+      defining = previousDefining;
     }
     expect(";");
     for (let index = formal.length - 1; index >= 0; index--) {
-      if (values[index]) body = { kind: "bind", name: values[index], source: formal[index], body };
+      if (values[index]) body2 = { kind: "bind", name: values[index], source: formal[index], body: body2 };
     }
     parameters.clear();
-    for (const value of values) if (value) bindings.delete(value);
-    definitions.set(`${name.text}/${formal.length}`, { kind: "invoke", parameters: formal, args: [], body });
+    for (const [name2, value] of previousParameters) parameters.set(name2, value);
+    bindings.clear();
+    for (const [name2, value] of previousBindings) bindings.set(name2, value);
+    definitions.clear();
+    for (const [name2, value] of previousDefinitions) definitions.set(name2, value);
+    entry.definition.body = body2;
+    definitions.set(signature, entry);
     budget.collection(definitions.size);
-    bodies.push(body);
-  }
+    bodies.push(body2);
+    return entry.definition;
+  };
+  const entries = [];
+  while (accept("def")) entries.push(definition());
   if (module && peek().kind !== "end") fail("module must contain only imports and definitions");
-  const ast = module ? { kind: "identity" } : expression();
+  const body = module ? { kind: "identity" } : expression();
+  const ast = entries.length && !module ? { kind: "define", definitions: entries, body } : body;
   if (peek().kind !== "end") syntaxError(peek(), true);
   const pending = [ast, ...bodies].map((node) => ({ node, depth: 1 }));
   const errors = [];
   let errorBytes = 0;
+  const visited = /* @__PURE__ */ new Set();
   while (pending.length) {
     budget.step();
     const { node, depth } = pending.pop();
+    if (visited.has(node)) continue;
+    visited.add(node);
     if (depth > limits.maxAstDepth) throw new JqLimitError("maxAstDepth");
     const token = unresolved.get(node);
     if (token && node.kind === "call") {
@@ -641,8 +689,8 @@ jq: 1 compile error`, 3);
       continue;
     }
     const children = [];
-    if (node.kind === "invoke") children.push(node.body, ...node.args);
-    else if (node.kind === "label") children.push(node.body);
+    if (node.kind === "invoke") children.push(...node.args);
+    else if (node.kind === "label" || node.kind === "define") children.push(node.body);
     else if (node.kind === "binary") children.push(node.left, node.right);
     else if (node.kind === "bind") children.push(node.source, node.body);
     else if (node.kind === "destructure") {